David Rushmer
David Rushmer is a technology leader, product strategist, and security researcher specialising in areas of artificial intelligence, reverse engineering, malware analysis, and threat intelligence. With a career spanning offensive and defensive security disciplines, he has built and operated threat research and intelligence teams, developed security products, and helped organisations better understand and defend against emerging cyber threats.
As a Tech Evangelist at Hex-Rays, David focuses on bridging the gap between cutting-edge reverse engineering technology and the practitioners who rely on it every day. His expertise spans binary analysis, vulnerability research, malware investigation, threat intelligence generation, and the application of AI to complex cybersecurity challenges.
Session
This talk walks through how a $20 piece of cloud infrastructure became a fully functional threat intelligence pipeline. Starting with a simple honeypot, we capture an inbound attack, pivot back against the attacker's infrastructure using a reverse scan, discover an open staging server, and walk away with something most researchers only dream of — the actual source code behind the malware.
No enterprise budget. No team. No expensive tooling. Just cheap infrastructure, some curiosity, and attackers with terrible opsec.
We'll walk through the full attack chain in reverse — from the initial hit on the honeypot, through the pivot and enumeration of attacker infrastructure, to pulling the payload and source code from their own server. We'll then crack open both the binary in IDA Pro and the source code side by side, showing exactly what this bot was built to do and what the attacker left behind for anyone willing to look.
The key takeaway is simple — you don't need a SOC, a threat intel platform, or a six figure budget to find real malware in the wild. Sometimes the attackers do half the work for you.